← Directory

DVWA-Web

Damn Vulnerable Web Application (DVWA) is an intentionally vulnerable PHP/MariaDB web application designed for security professionals, developers, and…

  • Development
  • Other
  • Security
Damn Vulnerable Web Application (DVWA) is an intentionally vulnerable PHP/MariaDB web application designed for security professionals, developers, and students to practice identifying and remediating common web application vulnerabilities. It provides a straightforward interface with multiple difficulty levels covering both documented and undocumented vulnerabilities, making it a legal, controlled environment for testing skills and tools.

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

73/100 Good

Maintained
86last commit 6 days ago
Popular
8313,790 GitHub stars
Easy to install
351 install platform, install notes, Docker image
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today, links checked 14 days ago

GitHub stars
13,790
Open issues
7
Last commit
2026-10-07
Latest release
2.5
License
GPL-3.0
Activity
rising

Checked 6 days ago - source: GitHub (digininja/DVWA)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is not supported.

Checked 15 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Copy the config file first Run `cp config/config.inc.php.dist config/config.inc.php` before starting DVWA, and keep that file safe, because it holds database login details and other settings; without it or with wrong values, DVWA cannot connect to its database. source
  • Start DVWA on port 4280 Run `docker compose up -d` to start the DVWA container in the background, then open http://localhost:4280; port 4280 is the web port, so open it in your firewall or router if you are not browsing from the same machine. source
  • Run installer with sudo If using the Linux installer instead of Docker, download `Install-DVWA.sh`, run `chmod +x Install-DVWA.sh`, then run `sudo ./Install-DVWA.sh`; it needs administrator rights to set up the web server and database, or DVWA may fail to start. source

Fetched 6 days ago - each note links to its source

Alternatives (1)

  • VulnHub - To provide materials that allows anyone to gain practical 'hands-on' experience in digital security, computer software & network admini…

Checked 12 days ago - source: AlternativeTo

Common questions

What common setup errors should I check when DVWA pages are blank or fail?

DVWA troubleshooting for Ubuntu and Kali lists 404s, database connection failures, blank pages, missing PHP modules, and permission errors.

Why does DVWA not display after I complete the configuration on XAMPP?

The source only reports that DVWA’s webpage did not display after completing configuration while running it with XAMPP.

Why can’t I log out and log back into DVWA after reaching localhost/DVWA?

A Kali user reports being unable to log out and log back in after reaching DVWA at localhost/DVWA.

What should I do if DVWA works with 127.0.0.1/DVWA but does not otherwise?

The source does not provide a fix because nobody responded to the post.

Answers sourced from community.f5.com, muhammad-aqib-bashir.github.io, www.reddit.com, www.reddit.com

Community

Collected 14 days ago - public community threads